I'm trying out splunk for the first time (4.1.5) as a tool for chewing up audit logs. These logs are written out in XML format but I can't seem to get splunk to recognise them. It's sees .log and .txt extensions but not the xml files. When I look at the directory I'm monitoring I can see the count in splunk ,matches what's on my filesystem, it just doesn't index them.
I'm still looking at the documentation (RTFM) but any help would be appreciated.
I was having a challenging time to get XML indexed from a Windows server but finally got it in using the following:
[monitor://D:\data\applog\] sourcetype = applog_xml _whitelist = .*\.xml crcSalt = <SOURCE>
[applog_xml] MAX_EVENTS = 20000 TIME_PREFIX = \<TimeStamp\> MAX_TIMESTAMP_LOOKAHEAD = 500
So you are saying that splunk is not indexing these files? In other words, you cannot find them when you search for them? Do your XML files have timestamps? Have you tried searching over "all time"? It may be helpful if you post a sample XML event or two. (Use the "edit" link on your question above. After you paste your event, add 4 spaces to the front of each line to get this site for format your event properly.)